FunkSec is a relatively new but highly active ransomware group that, as of this writing, has targeted several dozen victims across industries like government, banking, communications, and education. In a recent blog post, the group announced a partnership with another ransomware outfit, FSociety, aiming to carry out attacks more efficiently.
This week, SonicWall Capture Labs research team analyzed the group’s malware, known as FunkLocker ransomware. Interestingly, rather than demanding massive payouts, FunkSec typically requests just 0.1 Bitcoin. This suggests they may be pursuing a “churn and burn” strategy — favoring a quick turnover approach to rapidly generate revenue.
Read more…
Source: SonicWall
Related:
- Dynowiper: Destructive Malware Targeting Poland’s Energy Sector
February 6, 2026
The coordinated destructive campaign against critical energy infrastructure occurred on December 29, 2025, during a period of severe winter weather in Poland. According to CERT Polska’s report, the campaign targeted: 30+ wind and solar farms across Poland; A major CHP plant supplying heat to nearly half a million customers; A manufacturing sector company characterized as an ...
- Pakistan, China to boost liaison in intelligence sharing, cybercrime prevention
February 6, 2026
Pakistan and China on Thursday agreed to enhance cooperation in intelligence sharing and cybercrime prevention. The understanding was reached during a meeting between Federal Interior Minister Mohsin Naqvi and Chinese Ambassador in Pakistan Jiang Zaidong. Upon his arrival at the Ministry of Interior, the Federal Interior Minister welcomed the Chinese Ambassador. During the meeting, detailed discussions ...
- Stan Ghouls targeting Russia and Uzbekistan with NetSupport RAT
February 5, 2026
Stan Ghouls (also known as Bloody Wolf) is an cybercriminal group that has been launching targeted attacks against organizations in Russia, Kyrgyzstan, Kazakhstan, and Uzbekistan since at least 2023. These attackers primarily have their sights set on the manufacturing, finance, and IT sectors. Their campaigns are meticulously prepared and tailored to specific victims, featuring a signature ...
- Substack confirms data breach affects users’ email addresses and phone numbers
February 5, 2026
Newsletter platform Substack has confirmed a data breach in an email to users. The company said that in October, an “unauthorized third party” accessed user data, including email addresses, phone numbers, and other unspecified “internal metadata.” Substack specified that more sensitive data, such as credit card numbers, passwords, and other financial information, was unaffected. In an ...
- Open the wrong “PDF” and attackers gain remote access to your PC
February 5, 2026
Cybercriminals behind a campaign dubbed DEAD#VAX are taking phishing one step further by delivering malware inside virtual hard disks that pretend to be ordinary PDF documents. Open the wrong “invoice” or “purchase order” and you won’t see a document at all. Instead, Windows mounts a virtual drive that quietly installs AsyncRAT, a backdoor Trojan that allows ...
- Data breach at govtech giant Conduent balloons, affecting millions more Americans
February 5, 2026
A data breach at government technology giant Conduent appears to affect far more people than first disclosed, with the number of victims potentially stretching to dozens of millions of people across the United States. The January 2025 ransomware attack, which knocked out Conduent’s operations for several days, is now known to affect at least 15.4 million ...